Suit: 185K spyware images sent to rental computers

Originally published February 28, 2013 at 12:00 am

Updated February 28, 2013 at 6:09 am

Spyware installed on computers leased from furniture renter Aaron's Inc. secretly sent 185,000 emails containing sensitive information - including pictures of nude children and people having sex - back to the company's corporate computers, according to court documents filed Wednesday in a class-action lawsuit.

Spyware installed on computers leased from furniture renter Aaron’s Inc. secretly sent 185,000 emails containing sensitive information – including pictures of nude children and people having sex – back to the company’s corporate computers, according to court documents filed Wednesday in a class-action lawsuit.

According to the filings, some of the spyware emails contained pictures secretly taken by the rental computers’ webcams or other sensitive information including Social Security numbers, social media and email passwords, and customer keystrokes, the Federal Trade Commission determined last year.

The attorneys also claimed Atlanta-based Aaron’s hasn’t properly notified at least 800 customers allegedly targeted by spyware made by DesignerWare, a company located in North East, Pa.

“Because Aaron’s has been so uncooperative in agreeing to give proper notice and assistance to its customers, we’ve had to ask the court to intervene and order them to do it, so that people can protect their most private kinds of rights and property,” said Maury Herman, a New Orleans attorney who was one of several to file the documents.

Aaron’s officials have previously said the company never installed the spyware on computers rented out of company-operated stores and blamed individual franchisees for installing it. But the new filings claim Aaron’s nonetheless received the secretly recorded data.

Aaron’s said in a statement that it disagrees with the claims in the lawsuit and will defend the case vigorously. The company reiterated its assertion that some of its 700 franchise stores used the spyware, not the 1300-plus company-owned stores.

Attorneys for DesignerWare didn’t immediately respond to a request for comment Wednesday.

The new allegations grew out of a Federal Trade Commission settlement last year and are contained in documents filed in U.S. District Court in Erie. That’s where a Casper, Wyo., couple, Brian and Crystal Byrd, have sued DesignerWare, Aaron’s, the local franchise from which they rented a computer in 2010, and 45 other unidentified franchises they believed were using the spyware.

The filings seek court permission to file a new complaint adding 54 franchisees based on the 185,000 emails since traced to Aaron’s computer servers.

“Aaron’s, like the proverbial ostrich, has buried its head in the sand, hoping this litigation would just go away without having to do anything to protect its customers,” the Byrds’ attorneys wrote.

The couple’s May 2011 lawsuit claimed the manager of the Casper store showed Brian Byrd a webcam picture of himself operating a rental computer after the manager activated the spyware in the process of trying to repossess the computer, which the manager mistakenly believed the Byrds hadn’t paid off under their rent-to-own agreement.

Attorneys for DesignerWare have since said in court documents its PC Rental Agent software is benign and simply helps rental companies track computer use and shut down the devices if customers don’t pay.

But the FTC found, in a settlement publicized in September, the software could do much more when “Detective Mode” was activated: Capturing screenshots, taking webcam images, logging keystrokes and forwarding that information to Aaron’s by email.

The FTC settlement bars DesignerWare, the Aaron’s franchise that operated the Wyoming store, and six other businesses that operated rental stores from using any location-tracking software without customer consent and from deceptively collecting information.

On Wednesday, attorneys for the Byrds also filed a new lawsuit in Fulton County, Ga. – where Atlanta is located – on behalf of a customer who claims an Oregon Aaron’s franchise tracked her physical location by having Detective Mode trace her WiFi use of the computer.

That lawsuit, and the new documents filed in the Byrd’s federal lawsuit, contends Aaron’s corporate officials condoned the widespread use of the spyware on franchise rental computers.